Payment Data and PCI-DSS: Security Requirements

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Companies that process payment data must meet the strict requirements of PCI-DSS or risk multimillion-real fines, loss of accreditation, and civil and criminal liability.

What PCI-DSS Is and Why It Matters for Your Company

PCI-DSS (Payment Card Industry Data Security Standard) is a global security standard created by the major credit and debit card brands to protect cardholder data when it is processed, stored, and transmitted. When we look at data protection in Brazil, we see that many companies still don’t realize that compliance with this standard is mandatory, and treat it as an optional recommendation. In reality, any organization that accepts, processes, stores, or transmits payment card data must comply with PCI-DSS, regardless of its size or transaction volume.

The standard was developed by the PCI Security Standards Council (PCI SSC), an entity founded in 2006 by the card brands Visa, Mastercard, American Express, Discover, and JCB. Since then, PCI-DSS has been updated several times, with version 4.0 being the most recent. It expands the requirements for multifactor authentication, encryption, and continuous monitoring. Version 4.0 made significant changes to the security approach, moving from a static checklist model to a customized risk-analysis methodology. This gives organizations greater flexibility in implementing controls, as long as they demonstrate equivalent effectiveness.

In Brazil, PCI-DSS is directly tied to the Lei Geral de Proteção de Dados (LGPD, Brazil’s General Data Protection Law, Law 13.709/2018), because payment card data counts as personal data. Failing to comply with PCI-DSS can therefore also amount to a violation of the LGPD, which significantly widens the range of liability. In addition to the administrative sanctions provided for in the LGPD (which include fines of up to 2% of revenue, capped at R$ 50 million per violation), a company may face contractual penalties imposed by acquirers and card brands, ranging from monthly fines to complete disqualification from processing electronic payments.

The 12 Core Requirements of PCI-DSS

PCI-DSS is organized into six control objectives, which break down into 12 core requirements. When we conduct payment data due diligence, these requirements serve as the backbone of the entire assessment. The first objective is building and maintaining a secure network. It requires installing and maintaining firewalls to protect cardholder data and prohibits using vendor-supplied default passwords for system security parameters.

PCI-DSS compliance is not a one-time event. It is an ongoing process of monitoring, updating, and validation that must be built into the organization’s corporate governance.

The second objective addresses protection of the cardholder data itself. Organizations must protect stored cardholder data through encryption, truncation, masking, and hashing, and must encrypt the transmission of that data over open, public networks. We have found that this is one of the most vulnerable points for Brazilian companies, especially those that still maintain legacy integrations with older payment systems, where card data travels without adequate encryption or is stored as plain text in internal databases.

The third and fourth objectives cover, respectively, maintaining a vulnerability management program (including malware protection and secure application development) and implementing strong access control measures. Here, it is worth highlighting the requirements to restrict access to cardholder data to only those people who actually need it to do their jobs (the principle of least privilege), to assign a unique ID to each person with computer access, and to restrict physical access to the data.

The last two objectives involve regularly monitoring and testing the network (tracking and monitoring all access to network resources and cardholder data, plus regular testing of security systems and processes) and maintaining a comprehensive information security policy. When we carry out compliance assessments, we find that the lack of a formal information security policy is one of the most common failures at midsize companies.

Compliance Levels and Obligations by Transaction Volume

PCI-DSS sorts organizations into four compliance levels, based on annual card transaction volume. Level 1 merchants process more than six million transactions per year. They must undergo annual audits by a Qualified Security Assessor (QSA) and have their networks scanned quarterly by an Approved Scanning Vendor (ASV). Level 2 merchants (between one and six million transactions) and Level 3 merchants (between 20,000 and one million e-commerce transactions) may complete self-assessments using the Self-Assessment Questionnaire (SAQ), supplemented by quarterly ASV scans. Level 4 merchants (fewer than 20,000 e-commerce transactions, or up to one million in total) also use the SAQ, with scanning requirements set by the acquirer.

Payment Data Due Diligence: How to Conduct the Assessment

Due diligence focused on payment data goes beyond simply checking for a current PCI-DSS certification. When we conduct this kind of assessment (whether in mergers and acquisitions, vendor selection, or internal audits), we take an approach that examines both formal compliance and how well the controls actually work in practice. The first step is to map the full flow of payment data within the organization, identifying every point where card data is captured, processed, stored, and transmitted.

Next, we review the existing compliance documentation. This includes the most recent Report on Compliance (ROC) or Self-Assessment Questionnaire (SAQ), the results of the quarterly ASV scans, penetration test reports, information security policies, and staff training records. We check how current these documents are, because expired certifications or scans with unresolved findings are significant risk indicators.

One aspect often overlooked in due diligence is the evaluation of the chain of vendors and service providers that have access to payment data. PCI-DSS requires the organization to maintain and implement policies and procedures to manage the service providers with whom cardholder data is shared. In practice, we find that many companies hand off payment processing to third parties without adequately verifying those partners’ compliance, creating significant blind spots in the data protection chain.

Legal Aspects of Liability for Incidents

Under Brazilian law, liability for incidents involving payment data can arise in several spheres. On the civil side, the Consumer Protection Code (Law 8.078/1990) establishes strict liability of the supplier for defects in the provision of services, which covers security failures that result in the leak of consumers’ payment data. The LGPD, for its part, provides that a controller or processor who causes property, moral, individual, or collective damage through the processing of personal data must compensate for it, and liability may be joint and several among the data processing agents.

On the administrative side, in addition to the LGPD sanctions imposed by the ANPD (Brazil’s National Data Protection Authority), companies may face penalties from the Central Bank of Brazil, which regulates payment institutions under Law 12.865/2013 and supplementary resolutions. The Marco Civil da Internet (Brazil’s Internet Civil Framework, Law 12.965/2014) also imposes security obligations for storing access logs and personal data, which apply to payment operations carried out in digital environments.

Practical Implementation: From Diagnosis to Compliance

The path to PCI-DSS compliance begins with an accurate diagnosis of the current state of payment data security in the organization. We recommend starting with a gap analysis that compares current practices against each of the standard’s 12 requirements. This analysis produces a clear map of existing noncompliance and lets you prioritize remediation based on the risk level associated with each gap identified.

Network segmentation is one of the most effective strategies for reducing the scope of PCI-DSS compliance. By isolating the Cardholder Data Environment (CDE) from the rest of the corporate network, the organization limits the number of systems, processes, and people subject to the standard’s requirements, which reduces implementation cost and complexity. Companies that take this approach from the start of their compliance project get faster, more sustainable results.

Strong encryption is another fundamental pillar. Card data must be encrypted both in transit (using protocols such as TLS 1.2 or higher) and at rest (using algorithms such as AES-256). Cryptographic keys must also be properly managed, with documented procedures for generating, distributing, storing, rotating, and destroying keys. We have found that poor key management is a recurring vulnerability, even in organizations that implement robust encryption in other respects.

Continuous monitoring and incident response complete the compliance cycle. Organizations must deploy intrusion detection and prevention systems (IDS/IPS), log and monitor all access to network resources and cardholder data, and run quarterly vulnerability scans and annual penetration tests. An incident response plan specific to payment data breaches must be documented, tested periodically, and known to everyone involved.

Trends and Updates: PCI-DSS 4.0 and the Future of Payment Security

Version 4.0 of PCI-DSS brought substantial changes that directly affect how organizations approach payment data security. Among the main new features is the customized approach, which allows organizations to demonstrate compliance through alternative controls, as long as they meet the security objective defined for each requirement. This flexibility recognizes that different technology environments may need different solutions to reach the same level of protection.

Multifactor authentication (MFA) was expanded in version 4.0. It is now required for all access to the cardholder data environment, not just for remote access as in earlier versions. This change reflects the understanding that insider threats and lateral movement within the network pose risks as significant as unauthorized external access. We have found that rolling out MFA at every access point to the CDE takes careful planning so that it does not disrupt operations or employee productivity.

Another relevant trend is the growing convergence between PCI-DSS requirements and the demands of data protection laws such as the LGPD and Europe’s GDPR. Organizations that take an integrated approach to compliance, treating payment data security and personal data protection as parts of a single governance program, achieve greater efficiency and consistency in the controls they implement. In our due diligence assessments, we see this integration as a positive sign of an organization’s maturity in data protection.

Advances in tokenization and point-to-point encryption (P2PE) are also transforming the compliance landscape. These technologies allow actual card data to be replaced with tokens, or encrypted from the point of capture, which sharply reduces risk exposure and the scope of PCI-DSS compliance. For companies launching or revising their compliance programs, adopting these technologies is an opportunity to build a more secure payment infrastructure by design.

This topic is directly related to API gateway security and access, which we cover in a dedicated article.

This topic is directly related to the right to be forgotten in the digital age, which we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.